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Abstract 

Fatal loss-of-control (LOC) accidents have been directly related to in-flight airframe icing. The 
prototype system presented in this paper directly addresses the need for real-time onboard envelope 
protection in icing conditions. The combinations of a-priori information and real-time aerodynamic 
estimations are shown to provide sufficient input for determining safe limits of the flight envelope during 
in-flight icing encounters. The Icing Contamination Envelope Protection (ICEPro) system has been 
designed and implemented to identify degradations in airplane performance and flying qualities resulting 
from ice contamination and provide safe flight-envelope cues to the pilot. Components of ICEPro are 
described and results from preliminary tests are presented. 

Nomenclature 


A stability matrix 

B control matrix 

b reference span 

c mean aerodynamic chord 

C/p rolling moment due to sideslip angle derivative, <3C/ /ofl 

Ci 5a rolling moment due to aileron deflection derivative, dCj /88 a 

C/ gj rolling moment due to rudder deflection derivative, oC) /88 r 

C/ p rolling moment due to nondimensional roll rate derivative, dCj / d{pb/2V ) 

Ci r rolling moment due to nondimensional yaw rate derivative, 8C; /8(rb 12V ) 

C,„ a pitching moment due to angle of attack derivative, 8C m /da 

C m&e pitching moment due to elevator deflection derivative, dC m / 88 e 

C mci pitching moment due to nondimensional pitch rate derivative, dC m / d(qc /2V) 
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Cjv normal force due to angle of attack derivative, oCy /da 

Cn 5s normal force due to elevator deflection derivative, oCy /88 e 

Cw q normal force due to nondimensional pitch rate derivative, oCy /8{qc 12V) 

C„p yawing moment due to sideslip angle derivative, dC n /d P 

C„ 5a yawing moment due to aileron deflection derivative, dC n /85 a 

C„ 5r yawing moment due to rudder deflection derivative, 8C n / 88 r 

C„ p yawing moment due to nondimensional roll rate derivative, dC n /d(pb 12V) 

C„ r yawing moment due to nondimensional yaw rate derivative, dC n /d(rb/ 2V ) 

C Y p side force due to sideslip angle derivative, 8Cy /dp 

Cy 5a side force due to aileron deflection derivative, 8Cy / 88 a 

C y , 6r side force due to rudder deflection derivative, oCy jobr 

C Yp side force due to nondimensional roll rate derivative, oCy /d(pb/ 2V ) 

Cy r side force due to nondimensional yaw rate derivative, oCy /d(rb/ 2V ) 

ISP Icing Severity Parameter 

J cost function 

LSE least-squared error 

RMS root-mean square 

t time 

U Theil coefficient 

u control vector 

u control vector predicted from inversion routine 

V true velocity, ft/s 

y, y measured and predicted output 

x state vector 

co frequency, rad/s 

0 parameter vector 


Introduction 

The University of Tennessee Space Institute (UTSI) in partnership with Bihrle Applied Research 
(BAR) is conducting a three-year cooperative research effort with NASA in response to the NASA 
Research Announcement (NRA) NNH06ZEA001N under Appendix B of the Aviation Safety Program. 
This research is being performed to develop an Icing Contamination Envelope Protection (ICEPro) 
system that meets the objectives defined under the Integrated Vehicle Health Management (IVHM) 
Project, topic IVHM 3.1, Environmental Hazards, which are caused by the “Effects of Icing on Aircraft 
State”. This paper presents the results of the first year and a half of research, which focuses on the 
concept, design, and development of a real-time vehicle state assessment system. 

Background 

Airframe icing continues to be a threat to aviation safety across the globe. Icing-induced loss of 
control incidents and accidents have occurred and continue to occur on all classes of aircraft — from 
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general aviation airplanes (Ref. 1) and business jets (Ref. 2), to transport category aircraft (Refs. 3 to 8). 
NASA recently published results from statistical analyses that examined trends of icing-related events 
over a 16-year period (1988 to 2003) (Ref. 9). The study showed that nearly 9-percent of all fatal 
accidents from Part 121 and Scheduled Part 135 operations occurred while flying in icing conditions. 
During an icing encounter, flight characteristics can be severely degraded if hazardous ice formations 
accrete on wings and tail surfaces due to improper use of the ice protection systems (IPS), IPS failure, or 
encountering “exceedence conditions”. Exceedence conditions occur when an aircraft is exposed to icing 
rates outside of the FAR 25 Appendix C criteria, for which the aircraft is certificated; Super-cooled Large 
Droplet (SLD) icing is one example. Each of these situations has caused serious aircraft handling 
problems and resulted in stall and/or departure from controlled flight. 

One notable accident referenced above involved an ATR 72 that flew through SLD icing conditions 
near Roselawn, Indiana on October 31, 1994. Even with the IPS operating normally, the aircraft 
experienced a roll control anomaly that led to the loss of control and impact into the ground. This accident 
and others since then have led to numerous safety recommendations from the National Transportation 
Safety Board (NTSB) (Refs. 10 and 1 1) and the Commercial Aviation Safety Team (CAST) (Ref. 12) and 
motivated research activities within NASA and the FAA. One NASA sponsored activity called the Smart 
Icing Systems was led by the University of Illinois, Urbana-Champaign (UIUC). The Smart Icing 
Systems took a systems level approach to detecting icing conditions, operating ice protection systems and 
alerting the flight crew to the status of the aircraft (Ref. 13). 

This work laid the foundation to continue research to develop and improve real-time state assessment 
methods for vehicle health management with application to detecting and mitigating icing hazards. This is 
now being pursued through a NASA Research Announcement with the University of Tennessee Space 
Institute and Bihrle Applied Research, Inc., in collaboration with NASA Glenn and NASA Langley 
Research Centers. The development of real-time state assessment methods and their use in defining flight 
and control limits on pilot displays are an essential aspect of this research effort. The eventual fusing of 
these methods with real-time or near real-time icing weather information will not only assist the pilot with 
the aircraft control task, but will further improve situational awareness and decision-making capability. 
This capability will allow pilots to continue safe flight while planning an icing escape strategy. 

The following sections of this paper provide details of the design, implementation, and verification 
process of this unique system. 


ICEPro Concept 

The ICEPro concept is best summarized by the hypothesis posed by the development team during 
preliminary stages of the design process. 

By the real-time processing of measured state and control information, estimates of stability and 
control can be used in conjunction with a knowledge base, comprised of a-priori data, to provide 
pilots with envelope-limiting cueing in order to avoid loss-of-control or adverse conditions resulting 
from in-flight icing. 

Perhaps the best place to begin the discussion of the system concept is to answer the question “How 
will the flight envelope be protected?” The ICEPro concept relies on the actions of a proficient pilot 
responding to appropriate cueing and information on the primary and secondary displays in the cockpit. It 
is believed that with these cues, both visual and aural, the pilot can make informed decisions as to how 
the airplane is being flown. 

With this assumption, the question can be asked “What cues should be provided to the pilot?” The 
ICEPro concept provides envelope protection by issuing advisories, cautions, and warnings in indications 
of airspeed limits, angle of attack limits, flap position limits, and control effectiveness status. The 
indications are intended to be consistent with typical advisories and warnings that appear on typical 


NASA/TM— 20 10-216072 


3 



displays such that they are intuitive and effective. Figure 1 provides an example of the cueing that is used 
in the system. 


Airspeed Cues 

Airspeed carats provide predicted values for high and low airspeed limits for the current aircraft 
configuration and predicted icing condition. 

Angle of Attack Brackets 

Angle of attack brackets provide maneuvering limits in pitch for the pilot. These limits are defined by 
a predicted stall angle of attack for the current configuration of the vehicle and contamination state, and 
the minimum safe angle of attack that is set to prevent tail stall or negative-g protection. 

Flap Position 

One of the most dangerous flight regimes for operation with ice is on approach. Often, deploying 
flaps in icing conditions can lead to severe degradations in stability and control. As a result, ICEPro 
provides a flap position indication that advises the pilot as to the state of the vehicle at the current flap 
deflection. As flaps are deployed during icing conditions, if the system detects degradations in stability 
and control, the indicator will change to an amber color, cautioning further deployment of the flaps. As 
the condition worsens, the indicator turns red, warning the pilot of the danger, advising him to stop 
deployment and retract the flaps until the condition is cleared. 

Stability and Control 

Stability and control indicators are provided to inform the pilot of an adverse change in the stability 
and or control in the pitch, roll, or yaw axes. These indications on the Primary Flight Display (PFD) are 
accompanied by indications on the Engine Indication and Crew Alerting System (EICAS) display 
showing flight control status display of control effectiveness and status, as well as detailed messaging. 

Climb Limiting 

A performance- based cue to provide the pilot an indication of climb potential given the current state 
of the aircraft, is a Climb Limit caution and warning. This indicator will provide the pilot with indication 
that the single-engine climb potential for the current flap setting has degraded below 100 ft per minute. 

To generate effective and reliable cueing, quite a bit of work is required behind the scenes to assess 
and predict the limits of the flight envelope. These predictions and assessments are carried out by making 
use of three key components: the knowledge base, state estimation, and system logic. 

The knowledge-base contains a-priori information about the subject aircraft in its uncontaminated, or 
“clean,” state as well as information describing the vehicle in its “worst-case” contaminated state. Next, 
components are designed to use measured data from the aircraft to estimate the current aerodynamic state, 
and detect changes. The most challenging part of the system development is the executive module, a 
component which uses the current state information and compares it with information extracted from the 
knowledge base to provide valid envelope protection cueing to the pilot. 

The sections below provide details of the system design and implementation, and the system 
evaluation process to be performed in the coming year. 
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Color-coded Color-coded 

Velocity Limit AOA Limit 
Carats Brackets 


Color-coded 
Flap Position and 
Flap Limit 
• Indicator ; 


Color-coded 
Control Surface 
Condition Indicators 


Control Surface 
Position Indicators 



Color-coded Coloi-coded Climb Limit Color-coded 

Flap Position Stability & Control Duetolcing Stability & Control 

Indicator Caution SWaming Lights Indicator Caution & Warning Messages 

Figure 1 . — ICEPro Envelope Protection Cues on the Primary Flight Display (left) and Flight Control Status Page 
(right) 


System Design 

The design of the system is based on three modes of operation: a MONITOR mode that provides 
initial detection of in-flight icing, an ID mode that provide a diagnosis of the condition, and a 
REPORTING mode, providing the prognosis of the condition and mitigation through cueing. Figure 2 
presents a simplified flow diagram of the system modes and states. Details, such as latching and 
delatching logic and specific logic for driving each of the caution/warning messages have been omitted to 
reduce the complexity of the diagram. 


Monitor Mode 

The purpose of the MONITOR mode is to provide the initial indication that the real time aircraft state 
has degraded from a nominal baseline condition. It is designed to passively monitor the aerodynamic state 
of the aircraft in two ways. Because drag rise is an early indication that ice contamination is present, the 
first parameter monitored is the drag of the vehicle, which is accomplished through comparisons of 
airspeed measurements and predictions of aircraft performance for the given conditions and 
configuration. For the second evaluation, a novel approach to assessing the stability and control of the 
airplane is used in parallel with the drag monitoring. This technique, the Dynamics Inversion Control 
Evaluation System (D-ICES) makes use of the system knowledge base to predict the control deflections 
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Monitor Mode 
IMODE = 0 


Flight Data 


D-ICES Data 
(drag + controls) 


IMODE = 0 
Stay in Monitor Mode 



Start RTPID 


ID Mode 
IMODE = 1 


a priori aero 
derivatives 


PID aero derivatives 


Calculate ISP 



No 




IMODE = 1 
ID Mode 



Check individual Stab & 
Control values + ROC 


Yes 


Report Mode 
IMODE = 2 


Yes 



No 


Update ISP 


Update Display 
Cautions /Warnings 




Figure 2. — Simplified ICEPro system state diagram. 
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D1 Derivative2 

Figure 3. — Tracking algorithm for acceleration signal input to the dynamic inversion scheme. 


necessary to achieve the vehicle motion. D-ICES tracks the current pitch, roll, and yaw rate in each axis 
using a proportional, integral, and derivative (PID) control with lead compensation (Figure 3). With this 
tracking, the amount of angular acceleration required to match the aircraft motion is determined. Using 
information from the knowledge base, predictions of the current “clean” stability of the vehicle are 
entered into the aircraft equations of motion along with weight and balance information and the tracking 
accelerations to compute a “residual” acceleration vector. 

By assuming this residual acceleration is a direct result of control movement, a prediction of control 
deflections can be obtained (Eq. (1)). Changes in the vehicle aerodynamic state from the “clean” can be 
detected by tracking these predictions of the control deflection in flight and comparing them to actual 
control deflections. 


■’‘Measured ^ '’’"Predicted + Bll Predicted 

^Predicted — ^Control ['’‘"Measured — ^Stability ''"Predicted ] 


( 1 ) 


The actual comparisons in the logic are based on the calculated Theil coefficients for velocity and 
elevator deflections. The Theil coefficients are used in a moving time window to evaluate how well the 
extracted data is matching the expected levels during that time period. These statistics form the basis for 
the Icing Severity Parameter to be discussed later in the paper. The form of the Theil coefficients is 
shown in Equation (2). 


U = 



i>-n 2 



LSE 
V RMS 


( 2 ) 


Combining the detection of control requirement change and the drag build-up prediction, preliminary 
indications of icing can be assumed when the Theil coefficients for these parameters exceed a threshold 
level that has been determined through simulated exercise of the system. This preliminary detection 
results in a system state switch to the ID mode. 
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ID Mode 


In the ID mode, estimates of the vehicle’s current aerodynamic state are computed by invoking real- 
time parameter identification (RTPID). The RTPID algorithm being employed was developed by Morelli 
(Ref. 14), and is based on a frequency domain approach implemented in version 2.0 of System 
IDentification Programs for AirCraft (SIDPAC) (Refs. 15 and 16). 

The approach uses a linearized model of the vehicle dynamics. Equation (3), where A, B , C, and D are 
matrices containing stability and control derivatives. 


x(t) = Ax(t) + R«(t) x(0) = x o 

y(t ) = Cx(f) + Du(t ) 


(3) 


Time-varying estimates of the stability and control derivatives are determined using measured 
airplane control surface deflections and measured states from air data, angular rates, and attitude. Outputs 
are rotational and translational accelerations. To determine the estimates, a cost function is formulated in 
the frequency domain from the Fourier transform of the model in Equation (3), 

y cox (to) = Ax(co) + Bu(co) 

(4) 

y(eo) = Cx(co) + D«(co) 


The cost function is 


j m 

J k=^Yj\j™nh( n )- a kx{ n )- b ku{ n )\ 


for m frequencies 


' n = 1 


(5) 


where a k and a k are the /cth row of matrices A and B, respectively, and x k (n) = x k (co„), u k (n) = u k (co„ ) . 

Each line in Equation (4) can be analyzed separately in this way, which implements an equation-error 
formulation (Ref. 14). The least squares cost function in each case can be formulated as 


j = I(y_X0) + (7-Xe) 

where ^ indicates complex conjugate transpose, 



M*k 0) 


1 

Si 

1 

Y = 


x = 



JVk (■ m )_ 


1 

T 

Si 

T 

i 


( 6 ) 


(7) 


and the u nk nown parameters from A and B are contained in the parameter vector 0. The least squares 
parameter vector estimate is obtained as the value of 0 that minimizes the cost function in Equation (6) 
(Ref. 14), 
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0 = 




cov 


2 

(e) = £ (e-e)(e-e) 



a 2 = — (7-X0)'(y-X0) 

777 ' ' ' ' 


Performing the identification in the frequency domain is advantageous for this application because of 
computational efficiency, robustness to noise and data dropouts, and reliable confidence bounds from the 
covariance matrix. To ensure reliable estimates, the ICEPro features a self checking algorithm that 
examines the confidence bound of the parameter estimates. Table 1 lists the parameters that are being 
identified in real-time. 


TABLE 1.— AERODYNAMIC PARAMETERS IDENTIFIED BY RTPID 
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If confidence of the estimated parameters falls below acceptable levels due to lack of data information 
content, an automated excitation of the aircraft control surfaces is triggered to improve data information 
content. This interface with the subject vehicle is performed as though an autopilot is driving control 
deflections using multi-frequency orthogonal inputs (Fig. 4) (Ref. 17). Amplitudes of the inputs are 
adjusted to provide excitation while minimizing vehicle motion. 



time, sec 

Figure 4. — Example of multi-frequency orthogonal inputs. 
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Once reliable estimates of the aerodynamics state (stability and control derivatives) are obtained, 
comparisons of this estimated state are made with knowledge-base predictions of the “clean” vehicle 
aerodynamics and “worse-case” vehicle aerodynamics. These comparisons are performed to establish an 
Icing Severity Parameter (ISP). The ISP varies from 0 to 1, where 0 indicates a “clean” configuration with 
no ice, and 1 indicating the worst case ice condition that is modeled in the system aerodynamics model. 
The level of the ISP triggers the next mode switch to Report mode and is used for several of the envelope 
protection predictions. The general form of the ISP calculation is the sum of the differences between the 
RTPID aerodynamic derivatives estimates and the knowledge base expected clean airplane values divided 
by the differences between the knowledge base iced and clean values, as shown in Equation (9). The 
terms used for the ISP calculation are those that show a significant enough difference due to icing. Term s 
with small icing effects are not included. 


ISP = 


I 


i = 1 


( Value eX p ec t ec i Va]uc atlua | 

( Value eX p ecte( j -Value iced ^ 
n 


(9) 


Report Mode 

Given the predicted ISP, while in reporting mode, the knowledge-base provides predictions of stall 
angle, minimum and maximum safe speeds for operation, as well as predictions of climb capability. It is 
these important pieces of information that drive the pilot cueing for envelope protection. Furthermore, 
comparison of the current estimates of aerodynamic parameters from the RTPID with clean predictions 
from the knowledge base provides measures of changes in stability margin, dynamic stability, and control 
effectiveness. When parameters exceed a predetermined threshold, advisories, cautions and warnings are 
issued accordingly to help the pilot keep the aircraft within a safe operating envelope. 


System Implementation 

The initial implementation of the ICEPro system is being performed on a DeHavilland DHC-6 Twin 
Otter, a high wing twin turboprop aircraft. This selection was made for several reasons. First, NASA 
Glenn Research Center has operated a modified Twin Otter as an icing research aircraft for over 25 years 
and has accumulated substantial data records of performance and stability and control effects due to icing. 
Secondly, NASA and BAR have developed simulation models of this aircraft in both clean and iced 
configurations to develop a concept demonstrator for including icing effects in initial and recurrent pilot 
training (Refs. 18 and 19). These data bases were extensively validated against flight data to insure that 
they accurately represent the baseline un-iced Twin Otter, as well as the iced airplane (Ref. 20). Thi s 
effort resulted in the Ice Contamination Effects Flight Training Device (ICEFTD) (Fig. 5), a portable 
flight training device that has been used in a number of workshops and seminars to demonstrate the 
undesirable effects of icing on flight characteristics (Refs. 21 and 22). The ICEFTD will be used in this 
current effort for pilot evaluations of the ICEPro system. The third reason for selecting the Twin Otter for 
the initial ICEPro implementation is the potential to migrate the system to the NASA Twin Otter Icing 
Research Aircraft for final demonstration of the system in real world conditions. 

The ICEPro system was developed and deployed in Bihrle Applied Research’s D-Six PC-Based 
simulation environment. All of the ICEPro functions, including the software for driving the flight displays 
are provided in a single computer that runs the software in real time. The system can be interfaced with 
the ICEFTD device or mounted in the NASA Twin Otter for flight demonstrations. A functional diagram 
of the ICEPro system is shown in Figure 6. The system consists of Data Acquisition and Executive 
functions which control the various modules that make up the system. 
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Figure 5. — NASA’s Ice Contamination Effects Flight Training Device (ICEFTD). 


INTERNAL (DSIX) PROCESSES 



Figure 6. — ICEPro System Design Functions. 
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The data acquisition portion receives data from the data bus on the airplane or from an emulation of 
the airplane data system if it is working with the simulator and not the airplane. It then makes the 
appropriate data available to the various other modules for processing and to the cockpit displays. The 
Executive portion provides all of the logic and calculation modules required to determine the icing state 
and what cues should be provided to the pilot. 

Knowledge Base 

All of the development effort has been done using the simulation of the Twin Otter as the aircraft. 

The knowledge base used by ICEPro is also a copy of the nonlinear data bases used in the simulation. The 
D-1CES algorithms were populated with data from the Twin Otter physics simulation. Although the 
system model and the physics model in the simulation contain identical data, the models are treated 
separately. The perfect a priori knowledge of the physics allows development of system logic and 
debugging. 


D-ICES 

As mentioned above, the ICEPro D-ICES system model was populated using data from the physics 
model of the Twin Otter. Using these data, the inversion control surface predictions and stability and 
control predictions matched the simulation perfectly. This arrangement, allowed for systematic tests to be 
performed on the system algorithms as well as system threshold settings. 

The D-ICES algorithm was implemented as a C/C++ code module into the D-Six Simulation 
environment running at 50 EIz. Figure 7 present examples of the D-ICES output for a no-ice and an iced 
condition. 


Clean Airplane Ice Contaminated Airplane 








Figure 7. — D-ICES output for a no-ice and an iced condition. 
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Clean Airplane Ice Contaminated Airplane 






Figure 8. — RTPID results from the ICEPro system. 


RTPID 

Since the real-time PID algorithms are natively coded in the S1DPAC MATLAB scripts, these scripts 
were used in the ICEPro system with little modification. A D-Six plug-in module was written to create an 
instance of a MATLAB engine. During simulation execution, the D-Six system loop made calls to the 
MATLAB engine to provide input data, execute RTPID functions, and retrieve results. This model also 
was executed at a 50Hz frame rate, figure 8 presents examples of typical RTPID results from the systems 
and shows the increase in the Theil inequality coefficient for the comparisons with two different 
situations. 


Logic Details 

The implementation of the logic tree was designed to allow researchers to easily modify system 
thresholds and parameters during testing and evaluation of the system. This was done through the use of 
an initialization text file that is loaded at a press of a button on the system GUI. Amongst the parameters 
available for system tuning are, data buffering times, latching and delatching times between modes, 
thresholds for tracking, and latching times for cautions and warnings. 


Future Effort: ICEPro System Evaluation 

Testing and evaluation of the ICEPro system will be accomplished to verify its functionality and to 
assess its utility in simulated icing scenarios, using the NASA Ice Contamination Effects Flight Training 
Device (ICEFTD). Functionality evaluations will be performed initially by UTSI and NASA personnel, 
and will focus on verification that the system performs as intended. Initial testing will also involve a pre- 
test screening of ICEPro in UTSI’s simulation laboratory to identify and correct any system anomalies 
before final integration with the ICEFTD. A test plan has been written, which defines eight test 
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procedures that will facilitate an evaluation of alert thresholds, cue implementation, messaging, display 
characteristics, and absence of nuisance alerts. The performance metrics in the test plan are based upon 
meeting certain airworthiness criteria from applicable paragraphs of Federal Aviation Regulations (FAR) 
Part 23 (Ref. 23) and the related icing Advisory Circular (AC) 23.1419-2D. The initial functionality 
evaluation will be assessed by performing the following test procedures as recommended in that AC: 

• Stalling speeds and maneuver margin with critical “normal” ice accretions — lg wings level stall 
condition 

• Turning flight and accelerated turning stalls 

• Climb — One Engine Inoperative (Normal, Utility, and Acrobatic) for aircraft that weigh more than 
6000 lb 

• Approach and landing with failure shape ice accretions 

• Og pushover maneuvers 

• Lateral-directional static stability 

• Static longitudinal stability 

• Dynamic longitudinal and lateral directional stability 

Once the initial functionality evaluation is successfully completed, further testing will be performed 
to evaluate the utility of ICEPro by two sample groups of ten pilots or more. These sample groups will be 
randomly selected from industry and government flight test organizations because the nature and 
objectives of this test favor those familiar with development and certification flight testing. One group of 
pilots will be a control group, who will fly the test scenario without the benefit of envelope protection 
cues, and the second group will be an experimental group who will fly the scenario with envelope 
protection cueing of ICEPro. The test scenario will be based on the subject pilots flying a flight planned 
route during which icing is encountered. The 1CEFTD will be programmed to “accrete ice” at a given rate 
as the pilot flies the required route, and must then safely maneuver for approach and landing. Both 
quantitative and qualitative data will be acquired during these tests. Quantitative data will include time 
histories of flight path maintenance, pilot control activity, and other performance parameters such as 
airspeed, angle of attack (AO A), and configuration management. Qualitative data will include pilot task 
assessments of workload using appropriate rating methodologies such as the NASA Task Load Index 
(TLX) (Ref. 24) or Cooper-Harper handling qualities rating scale (Ref. 25). Upon completion of testing, 
pilots will complete a Likert scale (Ref. 26) survey questionnaire that will solicit their opinions on cueing 
design and implementation, aircraft state awareness, flight safety, and perceived task performance. 
Quantitative data will be reduced to evaluate pilot error based on defined performance metrics related to 
the flight task. Qualitative data will be reduced to assess workload and pilot opinion. Data from the two 
groups will be then compared using descriptive and inferential statistical methods to determine how well 
the ICEPro system has met its design objectives. 

Operational Utility Assessment in a Simulated Real Time Icing Weather Condition 

Archived icing weather data has been obtained from the National Center for Atmospheric Research 
(NCAR), which will be integrated with the 1CEFTD and presented to the pilot on a separate map-type 
flight display. These data represent a known hazardous icing condition, which occurred on January 27, 
2004, in the Cleveland, Ohio area for a 3-hr period of time, and are in an ASCII format. The horizontal 
resolution is 5 km, and the vertical resolution is from 1000 to 12,000 ft. Notional cockpit displays of this 
weather condition have been designed, but are not finalized. The integration of these data with cockpit 
displays and ICEPro will support a realistic icing encounter simulation for pilot evaluations. Here, pilot in 
the loop participation will involve a single sample group of ten pilots or more, who represent a cross 
section of regional airline pilots. The test plan will provide a scenario, which will focus on the pilot’s use 
of simulated real-time weather data and envelope protection cueing to mitigate a potentially hazardous 
icing encounter. Quantitative data will consist of flight track time histories and altitude changes to record 
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the pilot’s tactical decisions. Qualitative data will be acquired in the form of a post-lCEPro test opinion 
survey to assess situation and state awareness, and the overall utility of the fully-integrated, real-time 
weather and envelope protection system. The results of these two pilot-in-the-loop simulations are 
expected to verify and validate the concepts originally proposed in meeting the expected outcomes of the 
NASA Research Announcement (NRA) Research Opportunities in Aeronautics (ROA-2006), 
NNH06ZNH001, topic 3.1, environmental hazards. 

Conclusion 

In keeping with the NASA goal to improve the safety of commercial and general aviation aircraft, an 
envelope protection system was developed using no direct ice detection devices. Through the use of 
measured data, a priori information, and real-time stability and control estimates, this system computes an 
icing severity parameter. This parameter is used to trigger appropriate pilot cueing to warn the pilot of 
hazardous conditions and provide guidance for action to mitigate the situation. The main advantage of the 
system is that it uses data that are readily available in modem avionics systems and once adjusted to 
specific aircraft makes and models, and mated to modem display systems, should provide sufficient pilot 
cueing for envelope protection against icing related incidents. 

At the time of writing, all subsystems, D-1CES and RTP1D algorithms have undergone unit-level 
checks and have been verified. In addition, logic paths have been tested and verified. Currently, the 
system is undergoing comprehensive preliminary testing and adjustment. Final results are expected by the 
second quarter of 2009. 
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